A group of researchers from Ruhr-Universität Bochum demonstrated a new type of attack against 4G networks, IMP4GT, which allows attackers to perform activities as users. The vulnerability exists in the 4G mobile communication standard and uses a security vulnerability in LTE that lacks the protection of user data integrity to inject malicious content to mimic the victim. By doing the 4G LTE (IMP4GT) simulation attack, researchers found that attackers can inject arbitrary packets and obtain an existing software package against the payload. The IPV4 protocol in the Android system and the IPV6 protocol in both the iOS system and Android are vulnerable to the IMP4GT attack.
Researchers used two different variants of forgery attacks, that can be conducted in uplink and downlink direction, on the LTE communication network to undermine identity authentication and used the open-source LTE software stack srsLTE that comes from a software radio system to perform forgery attacks.
- With the uplink impersonation, the attacker impersonates a victim asking for a TCP/IP connection from a network. Later, it uses arbitrary IP services to generate traffic and associates them with the victim’s IP address.
- With the downlink impersonation, it allows an attacker to establish a TCP/IP connection to the phone that bypasses any firewall mechanism of the LTE network. Even though the hackers cannot break any security mechanism above the IP level, they can still bypass it.
The attack can allow attackers to make fraudulent purchases or subscribe to unwanted services. Attackers can also visit websites under someone’s identity to leak information or conduct malicious activities. The only way to mitigate the risk of exploitation is to change the hardware. The Bochum-based team is attempting to close the security gap in the latest mobile communication standard 5G, which is currently rolled out.
Researchers note that mobile network operators would have to endure higher costs for closing the data integrity gap during transmission. What’s about the cybersecurity gap in your organization? LIFARS Gap Assessment Solution is designed to ascertain your comprehensive information security, risk and compliance status (current). Not only we determine your current state along with your risk appetite and tolerance, but we also provide you with an actionable roadmap to reach target maturity level including strategy, structure, governance, and operations management plan.
Contact LIFARS Immediately for
Your Cybersecurity Mitigation Plan
Credits:
